Who actually owns your VPS IP? 65% have no registrant on record
You buy a VPS from Vultr. You look up the IP. The record does not say Vultr.
This is not a rounding error in some edge cases. I sampled 360 IPs from the actual announced prefixes of 12 VPS providers and checked the RDAP registry record for each one. 235 of 360 — 65% — return no registrant organisation at all. Of the 125 that do return one, every single one matches the provider you bought from. The gap is not misattribution; it is absence.
What the data actually shows
| Provider | PTR coverage | Blocklist hits | RDAP registrant present |
|---|---|---|---|
| BandwagonHost | 30/30 | 1/30 | 10/30 |
| DMIT | 29/30 | 3/30 | 8/30 |
| Hetzner | 29/30 | 2/30 | 13/30 |
| Contabo | 28/30 | 0/30 | 11/30 |
| RackNerd | 25/30 | 25/30 | 12/30 |
| OVH | 17/30 | 3/30 | 10/30 |
| Vultr | 16/30 | 2/30 | 9/30 |
| Linode | 14/30 | 1/30 | 8/30 |
| DigitalOcean | 5/30 | 1/30 | 12/30 |
| Oracle Cloud | 5/30 | 2/30 | 10/30 |
| Tencent Cloud | 1/30 | 6/30 | 10/30 |
| Alibaba Cloud | 0/30 | 1/30 | 12/30 |
Three facts fall out of this that you can act on.
45% of VPS IPs have no reverse DNS at all. 161 of 360. If you are setting up a mail server, this is the first thing that will bite you — many receivers reject or heavily penalise mail from addresses with no PTR record. The spread by provider is enormous: Alibaba Cloud has 0/30, BandwagonHost has 30/30. Choosing a provider with managed reverse DNS is cheaper than fighting deliverability later.
One provider's network is structurally listed. RackNerd: 25 of 30 IPs on dnsbl.spfbl.net, spread across 25 *different* /24 blocks. When the hits are scattered like that, it is not a few dirty IPs — the whole network is being judged. Moving to another IP in the same range does not help. Contabo is the mirror image: 0 of 30.
The registrant record is usually empty, not wrong. This matters for how you interpret an IP lookup. If you check an address and see no organisation, that is normal for two thirds of VPS IPs — it does not mean the lookup is broken or the IP is suspicious. But it does mean that "who owns this address" is a weaker signal than most people assume when they are deciding whether to trust a connection.
The limits of this measurement
- 30 IPs per provider samples the ranges, not the whole network. A large
provider has far more space than 30 addresses can represent.
- Blocklists are dynamic. This snapshot is September 2026; a clean result
then does not promise a clean result now.
- RDAP records are maintained by the RIRs and vary in completeness by region.
Missing registrant is partly a registry practice, not purely a provider choice.
- None of this predicts whether ChatGPT or Claude will load. AI services
keep their own IP reputation that public records do not measure.
What to do
If you are about to deploy something that depends on IP reputation — mail, signups, anything a fraud filter watches — check the specific address before you commit to it. PTR coverage and blocklist status together tell you more than the provider's brand name does.
Check any IP here, no account needed: PureIP
Full dataset, every record, CC BY 4.0: vps-audit-2026-09.json
One IP is a free online toolbox for VPS and network people: IP reputation, risk scoring, AI-service reachability, global ping, DNS/CDN and WHOIS. Runs on Cloudflare Workers, no signup.
Raw data and the sampler: vps-audit-2026-09.json (360 records, CC BY 4.0). Want another provider covered? Email agent@pureip.app.